What is the CVSS score of CVE-2026-33399?

CVE-2026-33399 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-33399?

Wallos subscription tracker versions before 4.7.0 contain an incomplete SSRF mitigation that allows authenticated users to bypass security controls and force the application to access internal or…. A patch is available.

How to fix or mitigate CVE-2026-33399?

Within 24 hours: Identify all Wallos deployments in your environment and document current versions. Within 7 days: Upgrade all Wallos installations to version 4.7.0 or later, prioritizing instances with internet-facing exposure or access to sensitive internal systems. Within 30 days: Audit notification and subscription endpoint configurations across all upgraded instances and implement network segmentation to restrict Wallos server outbound access to only required external domains.

PHP CVE-2026-33399

EUVD-2026-14945 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-03-24 GitHub_M

SSRF PHP

7.7

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:17 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

4.7.0

EUVD ID Assigned

Mar 24, 2026 - 18:15 euvd

EUVD-2026-14945

Analysis Generated

Mar 24, 2026 - 18:15 vuln.today

CVE Published

Mar 24, 2026 - 17:43 nvd

HIGH 7.7

DescriptionGitHub Advisory

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.0, the SSRF fix applied in version 4.6.2 for CVE-2026-30839 and CVE-2026-30840 is incomplete. The validate_webhook_url_for_ssrf() protection was added to the test* notification endpoints but not to the corresponding save* endpoints. An authenticated user can save an internal/private IP address as a notification URL, and when the cron job sendnotifications.php executes, the request is sent to the internal IP without any SSRF validation. This issue has been patched in version 4.7.0.

AnalysisAI

An incomplete Server-Side Request Forgery (SSRF) mitigation in Wallos, a self-hostable subscription tracker, allows authenticated attackers to bypass security controls and force the application to make requests to internal or private IP addresses. Wallos versions prior to 4.7.0 are affected. The vulnerability occurs because SSRF validation was added to test notification endpoints but not the corresponding save endpoints, enabling attackers to store malicious URLs that execute without validation when the cron job runs. No active exploitation (KEV) or public POC is currently documented.

Technical ContextAI

Wallos is a PHP-based open-source subscription tracking application identified by CPE cpe:2.3:a:ellite:wallos. This vulnerability is classified under CWE-918 (Server-Side Request Forgery), a security weakness where an attacker can abuse server-side functionality to make HTTP requests to arbitrary destinations. The issue stems from an incomplete fix for previous SSRF vulnerabilities (CVE-2026-30839 and CVE-2026-30840). While version 4.6.2 introduced the validate_webhook_url_for_ssrf() function to protect test notification endpoints, the developers failed to apply the same validation to the save notification endpoints. When authenticated users configure notification webhooks and save them through unprotected endpoints, these URLs bypass SSRF checks. The vulnerability materializes when the sendnotifications.php cron job executes, sending requests to the stored URLs without any validation, potentially targeting internal network resources, cloud metadata services, or other restricted endpoints.

RemediationAI

Upgrade Wallos to version 4.7.0 or later, which includes the complete SSRF validation fix as documented in the GitHub security advisory at https://github.com/ellite/Wallos/security/advisories/GHSA-mfjc-3258-cq3j. The specific patch commit can be reviewed at https://github.com/ellite/Wallos/commit/e87387f0ebb540cd33e6dfda7181db9db650ecef. Until patching is completed, implement compensating controls including restricting the application's outbound network access using firewall rules or network segmentation to prevent connections to internal IP ranges (RFC 1918 addresses, link-local addresses, localhost), cloud metadata endpoints (169.254.169.254), and other sensitive internal resources. Review existing notification webhook configurations for any suspicious internal IP addresses or localhost references that may have been saved by authenticated users. Consider implementing additional application-level authentication and authorization controls to limit which users can configure notification webhooks.